CVE-2026-64473

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64473", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.790Z", "datePublished": "2026-07-25T08:51:36.702Z", "dateUpdated": "2026-08-17T04:56:19.303Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:56:19.303Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio: Remove device debugfs before releasing devres\n\nVFIO device debugfs files created with debugfs_create_devm_seqfile()\nstore a devres allocated debugfs_devm_entry as inode private data.\nvfio_unregister_group_dev() currently calls vfio_device_del() before\nvfio_device_debugfs_exit(), but device_del() releases devres. This can\nleave debugfs entries visible with stale inode private data while\nunregister waits for userspace references to drain.\n\nRemove the per-device debugfs tree before vfio_device_del(). The debugfs\nview is diagnostic only, so losing it at the start of unregister is\npreferable to preserving entries whose backing storage may already have\nbeen released.\n\nComplete the teardown by clearing the per-device debugfs root after\nremoval. This matches the global debugfs root cleanup and prevents\nfuture users from mistaking a removed dentry for a live debugfs tree\nduring the remainder of unregister."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vfio/debugfs.c", "drivers/vfio/vfio_main.c"], "versions": [{"version": "2202844e4468c7539dba0c0b06577c93735af952", "lessThan": "6cc60b41d61657dc469893d14e8e55d160056ff1", "status": "affected", "versionType": "git"}, {"version": "2202844e4468c7539dba0c0b06577c93735af952", "lessThan": "a53109ffb6b5148e11a27fb7670355b92db12dd3", "status": "affected", "versionType": "git"}, {"version": "2202844e4468c7539dba0c0b06577c93735af952", "lessThan": "a5df401dc84f091e20b045560569f0736758fea7", "status": "affected", "versionType": "git"}, {"version": "2202844e4468c7539dba0c0b06577c93735af952", "lessThan": "dc7fe87de492ea7f33a72b78d26650b75bf37f4f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/vfio/debugfs.c", "drivers/vfio/vfio_main.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.96", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.39", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.4", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.96"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.39"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.1.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6cc60b41d61657dc469893d14e8e55d160056ff1"}, {"url": "https://git.kernel.org/stable/c/a53109ffb6b5148e11a27fb7670355b92db12dd3"}, {"url": "https://git.kernel.org/stable/c/a5df401dc84f091e20b045560569f0736758fea7"}, {"url": "https://git.kernel.org/stable/c/dc7fe87de492ea7f33a72b78d26650b75bf37f4f"}], "title": "vfio: Remove device debugfs before releasing devres", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/vfio/debugfs.c", "drivers/vfio/vfio_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6cc60b41d61657dc469893d14e8e55d160056ff1", "status": "affected", "version": "2202844e4468c7539dba0c0b06577c93735af952", "versionType": "git"}, {"lessThan": "a53109ffb6b5148e11a27fb7670355b92db12dd3", "status": "affected", "version": "2202844e4468c7539dba0c0b06577c93735af952", "versionType": "git"}, {"lessThan": "a5df401dc84f091e20b045560569f0736758fea7", "status": "affected", "version": "2202844e4468c7539dba0c0b06577c93735af952", "versionType": "git"}, {"lessThan": "dc7fe87de492ea7f33a72b78d26650b75bf37f4f", "status": "affected", "version": "2202844e4468c7539dba0c0b06577c93735af952", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/vfio/debugfs.c", "drivers/vfio/vfio_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.96", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.39", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E97CF8C4-8024-4996-ADD8-35BAE38BC68B", "versionEndExcluding": "6.12.96", "versionStartIncluding": "6.8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.2:rc1:*:*:*:*:*:*", "matchCriteriaId": "5E8B9085-7ADB-4A05-89EF-12949B6A0509", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvfio: Remove device debugfs before releasing devres\n\nVFIO device debugfs files created with debugfs_create_devm_seqfile()\nstore a devres allocated debugfs_devm_entry as inode private data.\nvfio_unregister_group_dev() currently calls vfio_device_del() before\nvfio_device_debugfs_exit(), but device_del() releases devres. This can\nleave debugfs entries visible with stale inode private data while\nunregister waits for userspace references to drain.\n\nRemove the per-device debugfs tree before vfio_device_del(). The debugfs\nview is diagnostic only, so losing it at the start of unregister is\npreferable to preserving entries whose backing storage may already have\nbeen released.\n\nComplete the teardown by clearing the per-device debugfs root after\nremoval. This matches the global debugfs root cleanup and prevents\nfuture users from mistaking a removed dentry for a live debugfs tree\nduring the remainder of unregister."}], "id": "CVE-2026-64473", "lastModified": "2026-11-12T18:03:24.620", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-07-25T10:17:32.757", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6cc60b41d61657dc469893d14e8e55d160056ff1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a53109ffb6b5148e11a27fb7670355b92db12dd3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a5df401dc84f091e20b045560569f0736758fea7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dc7fe87de492ea7f33a72b78d26650b75bf37f4f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: vfio: Remove device debugfs before releasing devres", "id": "2507094", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507094"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in the VFIO (Virtual Function I/O) subsystem of the Linux kernel. During device unregistration, debugfs (a diagnostic filesystem) entries might remain visible with outdated or \"stale\" data after the associated resources have been released. This occurs because the debugfs entries are not removed before the device resources are deallocated. While primarily affecting diagnostic views, this could lead to an attacker observing incorrect system state."], "name": "CVE-2026-64473", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64473\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64473\nhttps://lore.kernel.org/linux-cve-announce/2026072546-CVE-2026-64473-685a@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2202844e4468c7539dba0c0b06577c93735af952,6cc60b41d61657dc469893d14e8e55d160056ff1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2202844e4468c7539dba0c0b06577c93735af952,a53109ffb6b5148e11a27fb7670355b92db12dd3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2202844e4468c7539dba0c0b06577c93735af952,a5df401dc84f091e20b045560569f0736758fea7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2202844e4468c7539dba0c0b06577c93735af952,dc7fe87de492ea7f33a72b78d26650b75bf37f4f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.96,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.39,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.4,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T22:15:03.724132+00:00", "updated": "2026-08-02T12:30:05.807042+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}